PRIVACY POLICY

of the online store www.rewana.sk

1. Data Controller

The operator of the online store www.rewana.sk and the controller of personal data is:

Renovint, s.r.o.
Registered office: Chocholná-Velčice 261, 913 04 Chocholná-Velčice, Slovak Republic
Company ID (IČO): 47 951 303
Tax ID (DIČ): 2024160853
VAT ID (IČ DPH): SK2024160853

E-mail: info@rewana.sk
E-mail for orders and customer service: objednavky@rewana.sk

hereinafter referred to as the “Controller”.

2. Legal Framework

The Controller processes personal data in accordance in particular with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council – the General Data Protection Regulation (“GDPR”),
• Act No. 18/2018 Coll. on Personal Data Protection, as amended,
• Act No. 452/2021 Coll. on Electronic Communications, as amended,
• and other generally applicable legislation.

This Privacy Policy explains what personal data we process, for what purposes and on what legal basis, to whom the data may be disclosed and what rights data subjects have.

3. Personal Data We Process

Depending on how you use our online store or communicate with us, we may process in particular the following personal data:

3.1 Identification Data

In particular:

• first and last name,
• business name if you purchase as a business customer,
• Company ID, Tax ID and VAT ID if provided when placing an Order.

3.2 Contact Details

In particular:

• e-mail address,
• telephone number,
• billing address,
• delivery address.

3.3 Order Data

In particular:

• Goods ordered,
• size, colour or other selected variant,
• Order value,
• delivery method,
• payment method,
• Order status,
• Order history,
• information concerning returns, exchanges or complaints.

3.4 Payment Data

We process information necessary to confirm and record payments, such as the payment method, payment status and related transaction identifiers.

When payment is made through a payment gateway, payment card data is processed by the relevant payment service provider. The Controller generally does not have access to the full payment card details.

3.5 Communication Data

If you contact us by e-mail, through a form or by another method, we may process:

• the content of the communication,
• your contact details,
• information relating to your request, Order or complaint.

3.6 Technical Data

When you use the online store, certain technical data may be processed automatically, including:

• IP address,
• device type,
• browser type and version,
• operating system,
• time of visit,
• pages visited,
• cookie and similar technology identifiers,
• technical and security information necessary for the operation of the online store.

4. Purposes and Legal Bases for Processing

4.1 Processing Orders and Performing the Contract

We process personal data in particular to:

• receive and process Orders,
• conclude and perform the Purchase Contract,
• receive payment,
• arrange the manufacture or modification of ordered Goods,
• deliver Goods,
• communicate regarding Orders,
• process returns or exchanges.

Legal basis: Article 6(1)(b) GDPR – performance of a contract or taking steps prior to entering into a contract.

Providing the information necessary to process an Order is a contractual requirement. Without this information, we cannot properly process the Order.

4.2 Compliance with Legal Obligations

We also process personal data for:

• accounting,
• tax records,
• issuing and retaining invoices,
• compliance with consumer protection and other statutory obligations,
• handling statutory consumer rights.

Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation.

4.3 Complaints and Legal Claims

We process personal data for:

• handling complaints,
• withdrawals from Contracts,
• resolving consumer requests,
• establishing, exercising or defending legal claims.

Legal basis: depending on the circumstances, Article 6(1)(b), (c) or (f) GDPR.

The Controller’s legitimate interests include protecting its rights, keeping appropriate business records and establishing or defending legal claims.

4.4 Customer Communications

If you contact us with a question or request, we process the information necessary to deal with it.

Legal basis: depending on the nature of the communication, Article 6(1)(b) or (f) GDPR.

4.5 Security and Protection of the Online Store

Technical data may be processed to:

• ensure the proper functioning of the website,
• protect accounts and Orders,
• prevent fraud and misuse,
• protect information systems,
• diagnose technical problems.

Legal basis: Article 6(1)(f) GDPR – the Controller’s legitimate interest in the secure and reliable operation of the online store.

4.6 Marketing and Newsletter

Where you have consented to receiving marketing communications or our newsletter, we process your e-mail address and, where applicable, other information necessary for this purpose.

Legal basis: Article 6(1)(a) GDPR – consent.

You may withdraw your consent at any time, for example by using the unsubscribe link in a marketing e-mail or by contacting the Controller.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Where applicable law permits direct marketing to existing customers without separate consent, the customer always has the right to object to such use of their personal data easily and free of charge.

5. Cookies and Similar Technologies

The online store www.rewana.sk uses cookies and similar technologies.

5.1 Strictly Necessary Cookies

Strictly necessary cookies are used in particular to:

• ensure the proper functioning of the online store,
• operate the shopping cart,
• secure the website,
• remember essential technical settings,
• complete Orders.

Consent is not required for technologies that are strictly necessary to provide a service expressly requested by the user where applicable law provides such an exemption.

5.2 Analytics and Marketing Cookies

Analytics, advertising and other non-essential cookies are used only to the extent permitted by applicable law and generally only after you have given your prior consent.

You may refuse or subsequently change your consent through the cookie settings available on the website.

Refusing non-essential cookies should not prevent the basic use of the online store.

6. Recipients of Personal Data

We disclose personal data only to the extent necessary for the relevant purpose.

Recipients or processors may include in particular:

6.1 Shopify

The online store www.rewana.sk is operated using the Shopify platform.

For merchants in Europe, Shopify services are provided primarily through Shopify International Limited, Ireland.

For certain processing activities, Shopify acts as a processor of personal data on behalf of the Controller. For certain independent or additional services, Shopify may process certain personal data as a separate controller in accordance with its own terms and privacy notices.

6.2 Carriers

For the purpose of delivering an Order, we may provide the necessary personal data to Packeta or another carrier selected for the Order.

This may include in particular:

• first and last name,
• delivery address or pick-up point,
• telephone number,
• e-mail address,
• information necessary to identify the shipment.

6.3 Payment Service Providers

Where the customer uses electronic payment, the necessary personal data may be processed by the payment gateway provider, bank or other payment service provider used for the Order.

6.4 Accounting, IT and Other Service Providers

Personal data may also be made available to the extent necessary to:

• accounting and tax service providers,
• IT, hosting, security and technical support providers,
• e-mail and marketing service providers,
• other providers of services necessary for the operation of the online store.

6.5 Public Authorities

We may disclose personal data to courts, police authorities, tax authorities, supervisory authorities or other authorised bodies where we are legally required to do so or where necessary to protect our rights.

7. Transfers of Personal Data Outside the European Economic Area

When Shopify or other technology services are used, personal data may in certain circumstances be processed or transferred outside the European Economic Area (“EEA”).

For customers in the EEA, Shopify processes data through Shopify International Limited in Ireland and also uses affiliated companies and contracted subprocessors in other countries.

Where personal data is transferred to a country outside the EEA that is not covered by an adequacy decision of the European Commission, the transfer is carried out using appropriate safeguards under the GDPR, such as Standard Contractual Clauses or another valid legal transfer mechanism.

8. Retention of Personal Data

We retain personal data only for as long as necessary for the purpose for which it was collected or for the period required by applicable law.

In particular:

8.1 Orders, Invoices and Accounting Records

Information that must be retained under accounting or tax legislation is retained for the legally required period, generally 10 years for certain documents.

8.2 Complaints and Legal Claims

Documentation relating to complaints, withdrawals, disputes and legal claims is retained for the time required to resolve the matter and subsequently until the relevant limitation or statutory retention periods have expired.

8.3 Customer Account

Customer account information is processed while the account remains active and subsequently to the extent required to comply with legal obligations or protect legal claims.

8.4 General Enquiries and Communications

Communications that do not relate to an Order or other legal relationship are retained only for as long as necessary to deal with the request and for a reasonable subsequent record-keeping period.

8.5 Marketing

Personal data processed on the basis of consent for marketing purposes is processed until consent is withdrawn or until the relevant purpose of processing ceases to exist.

9. Rights of the Data Subject

Subject to the conditions laid down in the GDPR, you have in particular the following rights:

9.1 Right of Access

You have the right to obtain confirmation as to whether we process your personal data and, where we do, to obtain access to such data and relevant information about its processing.

9.2 Right to Rectification

You have the right to request correction of inaccurate personal data or completion of incomplete personal data.

9.3 Right to Erasure

In the circumstances provided for by the GDPR, you have the right to request deletion of your personal data.

This right is not absolute. Certain personal data must continue to be retained, for example to comply with legal obligations or to establish, exercise or defend legal claims.

9.4 Right to Restriction of Processing

In the circumstances provided for by the GDPR, you may request restriction of the processing of your personal data.

9.5 Right to Data Portability

Where the statutory conditions are met, you have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format and, where applicable, transmit that data to another controller.

9.6 Right to Object

Where we process personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object to such processing.

You may object to the processing of your personal data for direct marketing purposes at any time.

9.7 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time.

9.8 Right to Lodge a Complaint

If you believe that your personal data is being processed unlawfully, you have the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection of the Slovak Republic
Galvaniho Business Centrum II
Galvaniho 7/B
821 04 Bratislava
Slovak Republic

Website: www.dataprotection.gov.sk

This does not affect your right to seek judicial or other legal remedies.

10. How to Exercise Your Rights

You may exercise your rights by contacting the Controller:

Renovint, s.r.o.
Chocholná-Velčice 261
913 04 Chocholná-Velčice
Slovak Republic

E-mail: info@rewana.sk

When dealing with a request, we may reasonably ask for verification of identity where we have justified doubts regarding the identity of the person making the request.

We respond to requests within the time limits prescribed by the GDPR.

11. Automated Decision-Making and Profiling

The Controller does not itself carry out solely automated individual decision-making, including profiling, that produces legal effects concerning the customer or similarly significantly affects the customer, unless expressly stated otherwise for a particular service.

Certain Shopify services, advertising tools or analytics services may carry out automated analysis of user behaviour according to their configuration and applicable terms.

If the Controller activates a service that requires additional notice or consent from the data subject, the relevant information or consent will be provided or obtained in accordance with applicable law.

12. Security of Personal Data

The Controller implements appropriate technical and organisational measures to protect personal data against:

• unauthorised access,
• loss,
• destruction,
• alteration,
• unauthorised disclosure,
• or other unlawful processing.

Access to personal data is limited to persons and service providers who require it to perform their duties and who are subject to appropriate data protection obligations.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, in particular following changes in legislation, technologies used, service providers or our processing activities.

The current version is always published on www.rewana.sk.

Valid and effective from: 15 September 2026

Renovint, s.r.o.